What Privileged Access Tools Are
Written by MSP Outpost.
In Short
These tools control who can act as an administrator, and for how long. Some remove local admin rights from users and let them ask for a single approved action. Others keep technician and service account passwords in a vault, hand them out for one session and record what happens. Both cut the damage when a password or an account is stolen.
What It Does
- Remove local admin. Takes administrator rights away from everyday users without stopping them from doing their jobs.
- Elevation requests. Lets a user ask to run one program as an administrator, with an approval or a policy deciding the answer.
- Just-in-time access. Gives a technician elevated rights for a set time and removes them afterwards.
- Privileged vaulting. Holds admin and service account passwords and releases them only when needed.
- Password rotation. Changes a privileged password after each use, so a copied one stops working.
- Session records. Logs, and sometimes records, what was done under elevated rights.
- Approval workflow. Routes a request to the right person, with a reason and an expiry.
When You Need One
Remove standing local admin rights from clients where you can, and make sure your own technicians do not use one shared admin account everywhere. A full privileged access product can wait.
Technicians are working across many client networks, so shared admin passwords and permanent rights add up. Look for elevation that works without a visit, per-client policies and a clear record of who approved what.
Insurers, auditors and larger clients ask for time-limited access and a log of privileged actions. Expect to need approval workflows, rotation, and a way to keep one client's privileged accounts apart from another's.
How It Is Priced
Elevation tools are usually priced per endpoint or per user each month, while privileged account vaults are more often per user or per vaulted account, and some are quote only. Check whether a partner program bills monthly on actual use, whether there is a minimum per client, and whether approval workflows, rotation or session recording are in a higher tier.
Switching
Switching an elevation tool means changing the agent on every device, and rebuilding the rules that say which programs users may run. Run the old and new tools side by side on a pilot client first, because a missing rule shows up as a locked-out user. For a vault, find out how stored accounts and their history come out, and how long you keep access after you cancel.
Questions to Ask a Vendor
- What happens to a user who needs admin rights when the device is offline?
- Can I set elevation rules per client and per group, and copy them between clients?
- How are requests approved, and can approval happen from a phone?
- What does the log record, and how long is it kept?
- What is billed per endpoint, per user or per vaulted account, and is there a minimum?
- How do I get my rules and records out if I leave?
- How long does a deployment take on a client with no existing management tool?